XDPDROP

XDPDROP is a term sometimes used to refer to the action of discarding a packet within the Linux kernel’s eXpress Data Path (XDP) framework. The official spelling and symbol used by kernel documentation is XDP_DROP, and XDPDROP is often encountered as an informal variant or shorthand. In any case, the action signals that a packet should be discarded and not delivered to the kernel network stack.

In practice, an XDP program written in eBPF attached to a network interface can return XDP_DROP for a packet under certain conditions, such as when filtering rules or rate-limiting policies apply. When the kernel sees this action, it immediately discards the packet at the driver level, avoiding further processing in the network stack. This early drop provides very low latency and reduces processing load on the host.

Common use cases for the drop action include DDoS mitigation, simple access-control lists on ingress, and early-drop policies to protect services. Because dropping occurs at the earliest point in the receive path, it is one of the most efficient mechanisms for discarding traffic. Metrics such as drop counts are exposed to user space through standard interfaces and tooling that interact with XDP and eBPF.

XDP_DROP is part of the XDP feature set introduced in the Linux kernel and has evolved with improvements to eBPF verification and map handling. It should be used carefully to avoid unintended traffic loss and is typically used together with other actions such as XDP_PASS, XDP_TX, and XDP_REDIRECT for broader traffic control strategies.

See also: XDP, eBPF, XDP_PASS, XDP_TX, XDP_REDIRECT.